Data representation and security · GCSE Computer Science

Types of malware

GCSE Computer Science malware: virus, worm, trojan, spyware, ransomware — how each spreads, what damage it does, and basic prevention.

UNDERSTAND→RETRIEVE→REMEMBER
THE MEMORY HOOK
Virus needs a host file. Worm self-spreads across networks. Trojan disguises as legit. Spyware watches. Ransomware locks until you pay.

The important bits

What you need to know

  1. 1

    Malware is malicious software designed to harm, steal, disrupt or extort — viruses, worms, trojans, spyware, ransomware, adware.

  2. 2

    Virus: attaches to a host program or file, spreads when host is run or shared, needs user action to execute often.

  3. 3

    Worm: self-replicating, spreads across networks without needing a host program — exploits vulnerabilities automatically.

  4. 4

    Trojan: disguised as legitimate software; user installs willingly — does not self-replicate like virus but may open backdoor.

  5. 5

    Spyware: secretly monitors activity — keyloggers steal passwords, screen capture, browsing history sent to attacker.

  6. 6

    Ransomware: encrypts files or locks system, demands payment for decryption key — pay is discouraged, no guarantee.

  7. 7

    Prevention: anti-malware, firewalls, updates/patching, user training, backups, least privilege, email attachment caution.

  8. 8

    Social engineering often delivers malware — phishing link installs trojan; USB drop in car park.

Quotations worth analysing

Short evidence. Real method.

“Virus needs a host; worm spreads alone”
GCSE malware comparison

Classic exam contrast. Worm on unpatched SMB spreads network-wide. Virus in Word macro needs document opened.

“Trojan hides inside apparently useful software”
Trojan definition

Named after Trojan horse. User consent fooled. Not a virus unless it also replicates — category overlap in news, distinct in exams.

“Ransomware encrypts; payment does not guarantee recovery”
Cyber security teaching point

Backups are the recovery path. Paying funds criminals. GCSE prevention: offline backups, patch, train staff.

Go deeper

Spread mechanisms

Email attachment macro virus — user opens. Worm scans network for vulnerable port, copies itself — WannaCry SMB. Trojan fake game download installs keylogger. USB autorun legacy virus vector — disabled on modern OS but concept remains. Peer-to-peer trojan bundles. Spyware bundled with free toolbar. Ransomware phishing attachment encrypts documents folder, displays bitcoin address. Botnet: compromised machines (often worm/trojan) controlled remotely for DDoS — extension term.

Go deeper

Damage and detection

Virus corrupt or delete files, waste CPU. Spyware privacy breach, fraud. Ransomware business outage. Trojan backdoor allows remote access. Symptoms: slow system, pop-ups, files encrypted extension .locked, unknown processes. Anti-malware signature and heuristic scan. Integrity checks. IDS alerts. User reports phishing. GCSE: describe impact + prevention per type in table.

Go deeper

Prevention layered

Technical: firewall blocks ports, anti-malware real-time scan, auto-updates patch worm holes, application whitelisting in enterprise. Human: do not open unknown attachments, verify sender, least privilege accounts cannot install trojans admin-free. Backups offline protect from ransomware encryption of connected backup drive. Incident response: disconnect infected machine, restore from backup, report. Legal: Computer Misuse Act — creating/distributing malware is offence UK.

WORKED EXAMPLE

See the idea in action

Employee opens “invoice.exe” email attachment. Trojan installed disguised as PDF helper — spyware keylogger runs. Keys logged sent to attacker — credentials stolen. Alternatively attachment was ransomware — files encrypted, message demands payment. Prevention: email filtering, train staff on .exe attachments, anti-malware, backups, principle of least privilege preventing install.

Exam technique

Turn knowledge into marks

Define each malware type with spread method + damage. Pair with one prevention. Virus/worm distinction is a favourite 2-mark.

Common mistakes

Do not give these marks away

  1. 01

    Saying all malware is a virus — worm and trojan are separate categories.

  2. 02

    Claiming trojans self-replicate like worms without user action each time.

  3. 03

    Suggesting paying ransomware is the recommended recovery — backups and isolation first.

QUICK RETRIEVAL

Which malware spreads across networks without needing a host program?

AVirus

BWorm

CTrojan

DSpyware only

Show the answer

Worm. Worms self-replicate over networks. Viruses attach to hosts. Trojans rely on disguised install. Spyware spies, may not self-spread.

Quick questions

If this is the bit you searched

What is the difference between a virus and a worm?

Virus attaches to a host file and often needs it to run. Worm self-replicates and spreads across networks independently.

What is a trojan?

Malware disguised as legitimate software, installed by a user who believes it is safe.

How does ransomware work?

Encrypts files or locks the system, demanding payment for a decryption key. Recovery should use backups, not payment.

How can malware be prevented?

Anti-malware, firewalls, patching, user training, backups, least privilege, and cautious handling of attachments and links.